DOCSLIB.ORG

Code Intelligence

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Code Intelligence code intelligence Automated Application Testing for Java (including Web Services) CI Fuzz is a state-of-the-art security testing software. It offers easy integration saving developers’ time and manual effort while drastically improving the stability and reliability of the codebase. Fuzzing gained an enormous popularity both in the industry and scientific community in the last few years. For instance, 16.000 bugs have been automatically discovered in Google Chrome in 2019. While proven to be a very effective technology to find vulnerabilities and bugs, modern fuzzing is still too complex to integrate and maintain correctly for most development projects. Code Intelligences has the goal to make modern fuzzing more usable and thus to increase the security of their software. Why Code Intelligence? • Reduce costs: Save over 60% of developers time due to our fully automated solution and our easy-to-use IDE plugin • Fuzzing for everyone: Create and execute modern software tests without any expert knowledge supported by our preloaded settings and intelligent execution engine • Increase productivity: Maximize the productivity of your costly developers on programming code instead of the time-consuming task of hunting bugs and security issues • No prerequisites needed: Our agnostic approach ensures seamless integration into your existing process landscape • Access to state-of-the-art technology: Unparalleled combination of latest breakthrough technologies under one roof to deliver added business values • One-click setup: Quickly build intelligent tests for microservices using frameworks (e.g., Spring Boot) through our smart code scanning, detection, and automated execution technologies Methodology Our core technology consists of feedback-based fuzzing using instrumentation, the most promising dynamic code analysis technique. Here, the software under test is executed with inputs, which are systematically mutated during the testing process. In this process, the mutation engine gets coverage and data structure feedback from executed code via instrumentation. This allows the fuzzer to explore the program states effectively and thus significantly increase the code coverage and the number of triggered bugs and vulnerabilities. An initial static analysis of the code allows the deduction of the input structure and is used to guide the fuzzer allowing to produce inputs reaching important states in the program. code intelligence Usability CI Fuzz offers an easy-to-use interface to integrate modern testing techniques. No deep technical fuzzing knowledge is required to set-up the system. Instead, developers are able to define which program interfaces (e.g. REST MicroServices, Protobuf/GRPC services, or API functions) they want to have tested. CI Fuzz is then able to generate corresponding test cases automatically. Our user interface, available as IDE plugin or soon as web application, provides several dashboards and visualizes the fuzzing process by showing the parts of the code which have been reached by the fuzzer. Found crashes, information leaks and other types of vulnerabilities can also be replayed by starting the IDE’s debugger with the input causing the crash. Alternatively, you are able to interact with our core software using the command line. Continuous Integration CI Fuzz easily integrates into a standard CI/CD workflow (e.g., Jenkins). The fuzz tests are run automatically with each new code change and incidents are reported promptly. Fuzzing tests can be scaled on-demand on a Kubernetes cluster. Technical features • Feedback-based fuzzing based on instrumentation for Java and other JVM-based languages such as Kotlin or Scale. Frameworks such as Spring / Spring Boot / J2EE are supported • Low false-positive rate due to actual execution of the code rather than static analysis based on patterns and data flows • Structure-aware fuzzing approach for maximization of code coverage with support for custom data types and protocols defined in your own codebase with low integration effort • Automated API schema deduction for common serialization formats • Easy to integrate into Devops: Support for common build systems (e.g., Ant, Maven, Gradle) and Continuous Integration Pipelines (e.g. Jenkins, Gitlab Pipelines) • Automated fuzz test generation for API testing, including web services such as REST, SOAP, Protobuf/GRPC, and URLEncoded interfaces • Multitude of targets (Network, file and device-based interface fuzzing) code intelligence Identified Vulnerabilities With CI Fuzz you are able to discover the following vulnerabilities out of Mitre’s CWE Top 25: Improper Neutralization Improper Restriction of Improper Limitation of a Improper Neutralization of Special Elements used Operations within the Pathname to a Restricted of Special Elements used in an SQL Command (‚SQL Bounds of a Memory Directory (‚Path Traversal‘) in an OS Command (‚OS Injection‘) Buffer Command Injection‘) Improper Input Validation Use After Free Information Exposure Out-of-bounds Read Deserialization of Uncontrolled Resource Use of Hard-coded Use of Hard-coded Untrusted Data Consumption Credentials Credentials Improper Restriction Improper Control of Missing Release of Integer Overflow or of XML External Entity Generation of Code Resource after Effective Wraparound Reference (‚Code Injection‘) Lifetime NULL Pointer Out-of-bounds Write Dereference With CI Fuzz you are able to discover the following vulnerabilities out of OWASP Top 10: Injection Broken Authentication Sensitive Data Exposure XML External Entities (XXE) Broken Access Control Security Misconfiguration Insecure Deserialization Code Intelligence GmbH Contact Follow us Rheinwerkallee 6 +49 228 2869 5830 @CI_GmbH 53227 Bonn [email protected] company/codeintelligence/ www.code-intelligence.com.
Load more

Recommended publications
  • Operating Systems and Virtualisation Security Knowledge Area (Draft for Comment)
    OPERATING SYSTEMS AND VIRTUALISATION SECURITY KNOWLEDGE AREA (DRAFT FOR COMMENT) AUTHOR: Herbert Bos – Vrije Universiteit Amsterdam EDITOR: Andrew Martin – Oxford University REVIEWERS: Chris Dalton – Hewlett Packard David Lie – University of Toronto Gernot Heiser – University of New South Wales Mathias Payer – École Polytechnique Fédérale de Lausanne © Crown Copyright, The National Cyber Security Centre 2019. Following wide community consultation with both academia and industry, 19 Knowledge Areas (KAs) have been identified to form the scope of the CyBOK (see diagram below). The Scope document provides an overview of these top-level KAs and the sub-topics that should be covered under each and can be found on the project website: https://www.cybok.org/. We are seeking comments within the scope of the individual KA; readers should note that important related subjects such as risk or human factors have their own knowledge areas. It should be noted that a fully-collated CyBOK document which includes issue 1.0 of all 19 Knowledge Areas is anticipated to be released by the end of July 2019. This will likely include updated page layout and formatting of the individual Knowledge Areas. Operating Systems and Virtualisation Security Herbert Bos Vrije Universiteit Amsterdam April 2019 INTRODUCTION In this knowledge area, we introduce the principles, primitives and practices for ensuring security at the operating system and hypervisor levels. We shall see that the challenges related to operating system security have evolved over the past few decades, even if the principles have stayed mostly the same. For instance, when few people had their own computers and most computing was done on multiuser (often mainframe-based) computer systems with limited connectivity, security was mostly focused on isolating users or classes of users from each other1.
    [Show full text]
  • A Solution to Php Code Injection Attacks and Web
    INTERNATIONAL JOURNAL OF RESEARCH IN COMPUTER APPLICATIONS AND ROBOTICS Vol.2 Issue.9, Pg.: 24-31 September 2014 www.ijrcar.com INTERNATIONAL JOURNAL OF RESEARCH IN COMPUTER APPLICATIONS AND ROBOTICS ISSN 2320-7345 A SOLUTION TO PHP CODE INJECTION ATTACKS AND WEB VULNERABILITIES Venkatesh Yerram1, Dr G.Venkat Rami Reddy2 ¹Computer Networks and Information Security, [email protected] ²Computer Science Engineering, 2nd [email protected] JNTU Hyderabad, India Abstract Over the decade web applications are grown rapidly. This leads to cyber crimes. Attacker injects various scripts to malfunction the web application. Attacker injects these scripts to text box of vulnerable web application from various compounds such as search bar, feedback form, login form etc and later which is executed by the server. Sometimes attacker modifies the URL to execute a successful attack. This execution of system calls and API on web server by attacker can damage the file system and or leaks information of web server. PHP is a server side scripting language, dynamic features and functionalities are controlled through the PHP language. Hence, the use of PHP language results in high possibility of successful execution of code injection attacks. The aim of this paper is first to understand the code web application vulnerability related to PHP code injection attack, the scenario has been developed. Secondly defeat the attack and fast incident determination from the developed domain dictionary. This proposed system is helpful for cyber forensics expert to gather and analyze the evidence effectively Keywords: Code Injection, vulnerabilities, Attack, cyber forensics 1. INTRODUCTION The web environment is growing rapidly day by day, the cyber crimes also increasing rapidly.
    [Show full text]
  • Host-Based Code Injection Attacks: a Popular Technique Used by Malware
    Host-Based Code Injection Attacks: A Popular Technique Used By Malware Thomas Barabosch Elmar Gerhards-Padilla Fraunhofer FKIE Fraunhofer FKIE Friedrich-Ebert-Allee 144 Friedrich-Ebert-Allee 144 53113 Bonn, Germany 53113 Bonn, Germany [email protected] [email protected] c 2014 IEEE. Personal use of this material is per- implemented with different goals in mind, they share one mitted. Permission from IEEE must be obtained for all common feature: they all inject code locally into foreign other uses, in any current or future media, including process spaces. One reason for this behaviour is detection reprinting/republishing this material for advertising or avoidance. However, code injections are not limited to tar- promotional purposes, creating new collective works, for geted malware. Mass-malware also uses code injections in resale or redistribution to servers or lists, or reuse of any order to stay under the radar (ZeroAccess, ZeusP2P or Con- copyrighted component of this work in other works. ficker). Detection avoidance is not the only advantage of us- ing code injections from a malware author’s point of view. Abstract Further reasons for using code injections are interception of critical information, privilege escalation or manipulation of Common goals of malware authors are detection avoid- security products. ance and gathering of critical information. There exist The above mentioned examples are all malware fami- numerous techniques that help these actors to reach their lies for Microsoft Windows. However, code injections are goals. One especially popular technique is the Host-Based platform-independent. In fact all established multitasking Code Injection Attack (HBCIA).
    [Show full text]
  • Defeating Web Code Injection Attacks Using Web Element Attribute Mutation
    Session 1: New Moving Target Defenses MTD’17, October 30, 2017, Dallas, TX, USA WebMTD: Defeating Web Code Injection Attacks using Web Element Attribute Mutation Amirreza Niakanlahiji Jafar Haadi Jafarian UNC Charlotte University of Colorado Denver [email protected] [email protected] ABSTRACT injection and server-side script injection, they are still one of the Existing mitigation techniques for Web code injection attacks have most common attack vectors on Web applications; examples are the not been widely adopted, primarily due to incurring impractical recently discovered XSS vulnerabilities on Amazon [4] and Ebay overheads on the developer, Web applications, or Web browsers. [7] Websites. According to OWASP [21], XSS, the most prevalent They either substantially increase Web server/client execution time, type of Web code injection attacks, is the third Web application enforce restrictive coding practices on developers, fail to support security risk. legacy Web applications, demand browser code modification, or Methodologies for countering code injection attacks could be fail to provide browser backward compatibility. Moving Target De- broadly divided into two categories: (I) input validation techniques fense (MTD) is a novel proactive class of techniques that aim to that prevent injection of malicious code, but are highly suscepti- defeat attacks by imposing uncertainty in attack reconnaissance ble to evasion [23]; and, (II) code differentiation techniques that and planning. This uncertainty is achieved by frequent and ran- prevent execution of injected code, including BEEP [15] , ISR [17], dom mutation (randomization) of system configuration in a manner CSP [25], Noncespaces [27] and xJS [2]. However, as demonstrated that is not traceable (predictable) by attackers.
    [Show full text]
  • Arbitrary Code Injection Through Self-Propagating Worms in Von Neumann Architecture Devices
    Arbitrary Code Injection through Self-propagating Worms in Von Neumann Architecture Devices Thanassis Giannetsos1, Tassos Dimitriou1, Ioannis Krontiris2 and Neeli R. Prasad3 1Athens Information Tech. 19.5 km Markopoulo Ave. Athens, Greece 2Computer Science Dep. University of Mannheim D-68161 Mannheim, Germany 3Department of Communication Aalborg University Fr. Bajers Vej 7A5, DK-9220,Denmark Email: [email protected], [email protected], [email protected], [email protected] Malicious code (or malware) is de¯ned as software designed to execute attacks on software systems and ful¯ll the harmful intents of an attacker. As lightweight embedded devices become more ubiquitous and increasingly networked, they present a new and very disturbing target for malware developers. In this paper, we demonstrate how to execute malware on wireless sensor nodes that are based on the Von Neumann architecture. We achieve this by exploiting a bu®er overflow vulnerability to smash the call stack and intrude a remote node over the radio channel. By breaking the malware into multiple packets, the attacker can inject arbitrarily long malicious code to the node and completely take control of it. Then we proceed to show how the malware can be crafted to become a self-replicating worm that broadcasts itself and infects the network in a hop-by-hop manner. To our knowledge, this is the ¯rst instance of a self-propagating worm that provides a detailed analysis along with instructions in order to execute arbitrary malicious code. We also provide a complete implementation of our attack, measure its e®ectiveness in terms of time taken for the worm to propagate to the entire sensor network and, ¯nally, suggest possible countermeasures.
    [Show full text]
  • Study of Stenography and Forensic Analysis of Cyber Crimes Using Sql Injection Attack Viral Rajendrakumar Dagli, Surendranagar Dr
    Science, Technology and Development ISSN : 0950-0707 STUDY OF STENOGRAPHY AND FORENSIC ANALYSIS OF CYBER CRIMES USING SQL INJECTION ATTACK VIRAL RAJENDRAKUMAR DAGLI, SURENDRANAGAR DR. H. B. BHADKA, C U SHAH UNIVERSITY DR. K. H. WANDRA ABSTRACT Cyber Crime is normally comprehended to comprise of getting to a PC without the proprietor's consent, surpassing the extent of one's endorsement to get to a PC framework, changing or annihilating PC information or utilizing PC time and assets without appropriate approval. Cyber fear mongering comprises basically of undertaking these equivalent exercises to propel one's political or ideological closures. Psychological oppressor activities in the internet should be possible by confined people or fear monger gatherings, yet one state against another. By that, digital psychological warfare doesn't vary from other sort of fear mongering in any capacity. The particular idea of the risk can extend from forswearing of administration to listening in, extortion, damage, and robbery of licensed innovation and restrictive data. This paper expects to give a wide review of the difficulties looked by the world in digital wrongdoing and issues looked by law implementation organizations and Information and Communication Technology security masters in digital examinations and the advantages that might be picked up by the worldwide network and obviously the open private associations (PPP) to the anticipation, location and arraignment of digital violations and how underdeveloped nations need to keep pace with the consistently changing innovations and the control of this innovation by what we may term digital crooks so as to make benefit. Keywords: Cyber Crime, online frauds, SQL Injection INTRODUCTION Cybercrime is any crime that includes a PC, organized gadget or a system.
    [Show full text]
  • Model-Based Api Testing for Smt Solvers
    MODEL-BASED API TESTING FOR SMT SOLVERS Aina Niemetz ?y, Mathias Preiner ?y, Armin Biere ? ?Johannes Kepler University, Linz, Austria yStanford University, USA SMT Workshop 2017, July 22 – 23 Heidelberg, Germany SMT Solvers highly complex usually serve as back-end to some application key requirements: correctness robustness performance −! full verification difficult and still an open question −! solver development relies on traditional testing techniques 1/22 Testing of SMT Solvers State-of-the-art: unit tests regression test suite grammar-based black-box input fuzzing with FuzzSMT [SMT’09] generational input fuzzer for SMT-LIB v1 patched for SMT-LIB v2 compliance generates random but valid SMT-LIB input especially effective in combination with delta debugging not possible to test solver features not supported by the input language This work: model-based API fuzz testing −! generate random valid API call sequences 2/22 Model-Based API fuzz testing −! generate random valid API call sequences Previously: model-based API testing framework for SAT [TAP’13] implemented for the SAT solver Lingeling allows to test random solver configurations (option fuzzing) allows to replay erroneous solver behavior −! results promising for other solver back-ends Here: model-based API testing framework for SMT lifts SAT approach to SMT implemented for the SMT solver Boolector tailored to Boolector for QF_(AUF)BV with non-recursive first-order lambda terms −! effective and promising for other SMT solvers −! more general approach left to future
    [Show full text]
  • Devsecops DEVELOPMENT & DEVOPS INFRASTRUCTURE
    DevSecOps DEVELOPMENT & DEVOPS INFRASTRUCTURE CREATE SECURE APPLICATIONS PARASOFT’S APPROACH - BUILD SECURITY IN WITHOUT DISRUPTING THE Parasoft provides tools that help teams begin their security efforts as DEVELOPMENT PROCESS soon as the code is written, starting with static application security test- ing (SAST) via static code analysis, continuing through testing as part of Parasoft makes DevSecOps possible with API and the CI/CD system via dynamic application security testing (DAST) such functional testing, service virtualization, and the as functional testing, penetration testing, API testing, and supporting in- most complete support for important security stan- frastructure like service virtualization that enables security testing be- dards like CWE, OWASP, and CERT in the industry. fore the complete application is fully available. IMPLEMENT A SECURE CODING LIFECYCLE Relying on security specialists alone prevents the entire DevSecOps team from securing software and systems. Parasoft tooling enables the BENEFIT FROM THE team with security knowledge and training to reduce dependence on PARASOFT APPROACH security specialists alone. With a centralized SAST policy based on in- dustry standards, teams can leverage Parasoft’s comprehensive docs, examples, and embedded training while the code is being developed. ✓ Leverage your existing test efforts for Then, leverage existing functional/API tests to enhance the creation of security security tests – meaning less upfront cost, as well as less maintenance along the way. ✓ Combine quality and security to fully understand your software HARDEN THE CODE (“BUILD SECURITY IN”) Getting ahead of application security means moving beyond just test- ✓ Harden the code – don’t just look for ing into building secure software in the first place.
    [Show full text]
  • Model-Based API Testing for SMT Solvers∗
    Model-Based API Testing for SMT Solvers∗ Aina Niemetz, Mathias Preiner, and Armin Biere Institute for Formal Models and Verification Johannes Kepler University, Linz, Austria Abstract Verification back ends such as SMT solvers are typically highly complex pieces of soft- ware with performance, correctness and robustness as key requirements. Full verification of SMT solvers, however, is difficult due to their complex nature and still an open question. Grammar-based black-box input fuzzing proved to be effective to uncover bugs in SMT solvers but is entirely input-based and restricted to a certain input language. State-of-the- art SMT solvers, however, usually provide a rich API, which often introduces additional functionality not supported by the input language. Previous work showed that applying model-based API fuzzing to SAT solvers is more effective than input fuzzing. In this pa- per, we introduce a model-based API testing framework for our SMT solver Boolector. Our experimental results show that model-based API fuzzing in combination with delta debugging techniques is effective for testing SMT solvers. 1 Introduction State-of-the-art Satisfiability Modulo Theories (SMT) solvers are typically highly complex pieces of software, and since they usually serve as back-end to some application, the level of trust in this application strongly depends on the level of trust in the underlying solver. Full verification of SMT solvers, however, is difficult due to their complex nature and still an open question. Hence, solver developers usually rely on traditional testing techniques such as unit and regression tests. At the SMT workshop in 2009, in [10] Brummayer et al.
    [Show full text]
  • Continuous Testing for Devops Evolving Beyond Simple Automation
    Technical Whitepaper 1 Continuous Testing for DevOps Evolving Beyond Simple Automation INTRODUCTION DevOps represents a cultural shift that stresses collaboration be- on acceleration. Moreover, adopting a bona fide Continuous Testing tween the business, developers, and IT professionals. Software test process (more than just automated tests running regularly) helps automation can enhance these connections and help organizations promote all of the core pillars of DevOps: Culture, Automation, Lean, achieve desired SDLC acceleration, but it’s important to recognize Metrics, and Sharing. that automation is just one piece of the DevOps puzzle. In this paper, we’ll explore why and how Continuous Testing’s real- Since testing is often one of the greatest constraints in the SDLC, time objective assessment of an application’s business risks is a optimizing quality processes to allow testing to begin earlier, as well critical component of DevOps. as shrink the amount of testing required, can have a marked impact DEVOPS PRINCIPLES There are several key pieces to understanding DevOps revolutions and they are often brought about by a compelling event at an organization, such as a shift to agile. As organizations start to move into an agile development methodology, they start to uncover other processes that can be accelerated, such as delivery by DevOps and testing by Continuous Testing. The acceleration that is set in motion via agile makes it necessary to accelerate the release schedule. In order to ensure a successful release, an organization must adopt continuous testing to make sure the conveyer belt does not break down. The modernization maturity model has these three distinct phases: AGILE Agile software development is a different way of thinking about approaching the challenge of development time.
    [Show full text]
  • Revealing Injection Vulnerabilities by Leveraging Existing Tests
    Revealing Injection Vulnerabilities by Leveraging Existing Tests Katherine Hough1, Gebrehiwet Welearegai2, Christian Hammer2 and Jonathan Bell1 1George Mason University, Fairfax, VA, USA 2University of Potsdam, Potsdam, Germany [email protected],[email protected],[email protected],[email protected] Abstract just one of over 8,200 similar code injection exploits discovered in Code injection attacks, like the one used in the high-prole 2017 recent years in popular software [44]. Code injection vulnerabilities Equifax breach, have become increasingly common, now ranking have been exploited in repeated attacks on US election systems [10, #1 on OWASP’s list of critical web application vulnerabilities. Static 18, 39, 61], in the theft of sensitive nancial data [56], and in the analyses for detecting these vulnerabilities can overwhelm develop- theft of millions of credit card numbers [33]. In the past several ers with false positive reports. Meanwhile, most dynamic analyses years, code injection attacks have persistently ranked at the top rely on detecting vulnerabilities as they occur in the eld, which of the Open Web Application Security Project (OWASP) top ten can introduce a high performance overhead in production code. most dangerous web aws [46]. Injection attacks can be damaging This paper describes a new approach for detecting injection vul- even for applications that are not traditionally considered critical nerabilities in applications by harnessing the combined power of targets, such as personal websites, because attackers can use them human developers’ test suites and automated dynamic analysis. as footholds to launch more complicated attacks. Our new approach, Rivulet, monitors the execution of developer- In a code injection attack, an adversary crafts a malicious in- written functional tests in order to detect information ows that put that gets interpreted by the application as code rather than may be vulnerable to attack.
    [Show full text]
  • Operating Systems & Virtualisation Security Knowledge Area
    Operating Systems & Virtualisation Security Knowledge Area Issue 1.0 Herbert Bos Vrije Universiteit Amsterdam EDITOR Andrew Martin Oxford University REVIEWERS Chris Dalton Hewlett Packard David Lie University of Toronto Gernot Heiser University of New South Wales Mathias Payer École Polytechnique Fédérale de Lausanne The Cyber Security Body Of Knowledge www.cybok.org COPYRIGHT © Crown Copyright, The National Cyber Security Centre 2019. This information is licensed under the Open Government Licence v3.0. To view this licence, visit: http://www.nationalarchives.gov.uk/doc/open-government-licence/ When you use this information under the Open Government Licence, you should include the following attribution: CyBOK © Crown Copyright, The National Cyber Security Centre 2018, li- censed under the Open Government Licence: http://www.nationalarchives.gov.uk/doc/open- government-licence/. The CyBOK project would like to understand how the CyBOK is being used and its uptake. The project would like organisations using, or intending to use, CyBOK for the purposes of education, training, course development, professional development etc. to contact it at con- [email protected] to let the project know how they are using CyBOK. Issue 1.0 is a stable public release of the Operating Systems & Virtualisation Security Knowl- edge Area. However, it should be noted that a fully-collated CyBOK document which includes all of the Knowledge Areas is anticipated to be released by the end of July 2019. This will likely include updated page layout and formatting of the individual Knowledge Areas KA Operating Systems & Virtualisation Security j October 2019 Page 1 The Cyber Security Body Of Knowledge www.cybok.org INTRODUCTION In this Knowledge Area, we introduce the principles, primitives and practices for ensuring se- curity at the operating system and hypervisor levels.
    [Show full text]